What is a DDoS attack? How it works and how to stop it.
A DDoS attack tries to knock a website, game server or network offline by flooding it with traffic from thousands of machines at once. Here's how they work, the main types and what actually stops them.
DDoS attack definition
DDoS stands for distributed denial of service. A DDoS attack is a deliberate attempt to make a server, service or network unavailable by overwhelming it with more traffic or requests than it can handle. Genuine users then see slow loading, timeouts or complete outages.
The "distributed" part is the key. Instead of one machine sending the traffic, the attacker uses thousands or millions of compromised devices, called a botnet, so there is no single source to block.
How a DDoS attack works
- Recruit: the attacker infects devices such as insecure routers, cameras, servers and PCs, or rents access to an existing botnet.
- Command: the botnet is told to target one IP address or hostname.
- Flood: every device sends traffic at once. The target's bandwidth, CPU, memory or connection table runs out.
- Denial: legitimate traffic can't get through, because the resources it needs are already used up.
Some attacks use reflection and amplification: the attacker spoofs the victim's IP and sends small requests to public servers, which reply with much larger responses aimed at the victim. DNS, NTP and memcached have all been abused this way.
The three types of DDoS attack
1. Volumetric attacks
These try to saturate bandwidth. UDP floods and amplification attacks are the usual suspects. They're measured in bits per second and are stopped upstream, before they reach your server's link. This is what inline DDoS mitigation handles first.
2. Protocol attacks
These exhaust connection state in servers, firewalls and load balancers. SYN floods, fragmented packets and ping-of-death variants fall here. They're measured in packets per second and countered with SYN proxies, state validation and fragment filtering.
3. Application-layer attacks
These imitate real users: HTTP request floods, game query floods or fake logins. They use little bandwidth but are costly for your application to process. Protocol validators and rate limits that understand the service are the best defence.
Want concrete cases? See our DDoS attack examples.
Signs you're under attack
- Sudden, unexplained traffic spike or saturated bandwidth
- Site or game server slow, timing out or unreachable for everyone
- Huge numbers of requests from one region, or from many IPs hitting one URL
- Flood of SYN_RECV connections or UDP packets on one port
- Your host null-routes (blackholes) your IP
What is DDoS in gaming?
In gaming, DDoS usually means flooding a game server, or a player's home connection, to cause lag spikes, rubber-banding or disconnects. Game servers are common targets because their IPs are public and their UDP protocols are easy to spoof. The fix is protocol-aware filtering; read about game server DDoS protection.
How DDoS protection stops attacks
Effective protection works in layers: absorb volumetric floods on high-capacity transit, scrub protocol abuse at the network edge, and validate what remains against what your service should receive. Glitch Guard combines always-on volumetric mitigation with XDP packet filtering, SYN proxying and stateful connection tracking, without null-routing your IP. Read how to prevent DDoS attacks for a practical checklist.
FAQ
What does DDoS stand for?
Distributed denial of service: a denial-of-service attack launched from many machines at once.
What is the difference between DoS and DDoS?
A DoS attack comes from a single source. A DDoS attack is spread across many sources, usually a botnet, which makes it far harder to block.
How long do DDoS attacks last?
From seconds to days. Short bursts are common against game servers, while sustained campaigns target businesses. Always-on mitigation means you don't have to wait for it to end.
What is DDoS in gaming?
Flooding a game server or player connection with traffic to cause lag or disconnects. Game server DDoS protection filters that traffic so real players stay connected.
Is launching a DDoS attack illegal?
Yes. Launching or paying for a DDoS attack is a criminal offence in the UK under the Computer Misuse Act 1990, and illegal in most countries.
Keep reading
Stop attacks before they reach your server.
Add Glitch Guard to a Glitch Servers VPS, dedicated server or game server and manage every rule from the client area.